JasPer up to 4.2.5 Image Color Space Conversion jas_image.c jas_image_chclrspc null pointer dereference
Summary
A vulnerability, which was classified as problematic, has been found in JasPer up to 4.2.5. The affected element is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. This manipulation causes null pointer dereference.
The identification of this vulnerability is CVE-2025-8835. The attack can only be executed locally. Furthermore, there is an exploit available.
It is suggested to install a patch to address this issue.
Details
A vulnerability has been found in JasPer up to 4.2.5 and classified as problematic. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability.
The advisory is shared at github.com. This vulnerability is known as CVE-2025-8835. The exploitation appears to be easy. An attack has to be approached locally. Technical details and also a public exploit are known.
It is possible to download the exploit at drive.google.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 259916 (Linux Distros Unpatched Vulnerability : CVE-2025-8835), which helps to determine the existence of the flaw in a target environment.
Applying the patch bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52 is able to eliminate this problem. The bugfix is ready for download at github.com.
The vulnerability is also documented in the databases at Tenable (259916) and CERT Bund (WID-SEC-2025-1755). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Affected
- SUSE openSUSE
- Open Source JasPer
Product
Type
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒
CVSSv3
VulDB Meta Base Score: 4.0VulDB Meta Temp Score: 3.9
VulDB Base Score: 3.3
VulDB Temp Score: 3.0
VulDB Vector: 🔒
VulDB Reliability: 🔍
NVD Base Score: 5.5
NVD Vector: 🔒
CNA Base Score: 3.3
CNA Vector: 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Null pointer dereferenceCWE: CWE-476 / CWE-404
CAPEC: 🔒
ATT&CK: 🔒
Physical: Partially
Local: Yes
Remote: No
Availability: 🔒
Access: Public
Status: Proof-of-Concept
Download: 🔒
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Nessus ID: 259916
Nessus Name: Linux Distros Unpatched Vulnerability : CVE-2025-8835
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔒
Patch: bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52
Timeline
08/10/2025 Advisory disclosed08/10/2025 VulDB entry created
09/16/2025 VulDB entry last update
Sources
Advisory: 400Status: Confirmed
Confirmation: 🔒
CVE: CVE-2025-8835 (🔒)
GCVE (CVE): GCVE-0-2025-8835
GCVE (VulDB): GCVE-100-319369
CERT Bund: WID-SEC-2025-1755 - JasPer: Mehrere Schwachstellen
scip Labs: https://www.scip.ch/en/?labs.20161013
Entry
Created: 08/10/2025 13:19Updated: 09/16/2025 23:26
Changes: 08/10/2025 13:19 (61), 08/11/2025 16:02 (31), 08/11/2025 19:50 (7), 08/18/2025 08:26 (1), 08/31/2025 17:23 (2), 09/16/2025 23:26 (11)
Complete: 🔍
Submitter: nipc-cxd
Cache ID: 216::103
Submit
Accepted
- Submit #622408: JasPer The newest master && jasper-4.2.5 Null Pointer Dereference (by nipc-cxd)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.